Novel Quality Assurance Approaches for Web and IoT Systems

For years, web-based systems have supported our daily activities by keeping us always connected to the world. With the emerging Internet of Things (IoT) technology, the improvements to our lives have been pushed further, enabling physically and virtually interconnected devices to share data and offer a myriad of disparate services. To address the continuously growing customers’ expectations and the natural software evolution, both web and IoT based systems must undergo through rapid development cycles, supported by effective quality assurance strategies. In the web domain, agile approaches are considered appropriate to respond to fast requirements changes, in particular, the acceptance test driven development (ATDD) practice, which puts the testing activity on top of the software development process. However, applying ATDD can be difficult in practice, since existing web testing tools require an underlying running web application, which is usually missing at such early software development stage, without mentioning the non-trivial manual skills required to convert abstract test cases into executable test scripts. In the IoT domain, Node-RED recently emerged as a visual-based tool to offer a simple interface as a response to the complexity of deploying IoT systems, that often employ a plethora of different devices, each one to be configured separately. However, despite Node-RED claimed simplicity, assuring the quality of IoT systems is still an open problem and no consolidate approaches involving Node-RED exist. During my PhD thesis, I have investigated the twofold problem of assuring the quality of web and IoT based systems, by introducing a requirements specification as a backbone to drive the quality assurance process. Concerning the web domain, an ATDD approach has been proposed for developing and testing web applications, where the requirements specification, in the form of use cases, are enriched with HTML screen mockups representing the web application prototype, exposing from a functional point of view all its main functionalities. The developers and testers can then record the actions described in the use cases over thescreen mockups, with any capture and replay web testing tool, to produce a raw set of executable test scripts driving the development and refinement stages. The approach has been applied to re-develop the main features of an open-source web application. To overcome the limitations emerged during the application of the aforementioned approach, such as the manual activity required to generate and maintain the test scripts, as well as the burdensome task of keeping all the artifacts synchronized during the web application evolution, a second approach has been sketched. This second approach enforces the structure of the requirements specification with a UML model, and proposes a set of transformations to exploit the existing tools to semiautomatically generate the test scripts from the UML model and keep all the artifacts synchronized. Concerning the IoT domain, a set of guidelines has been proposed to support the development of Node-RED systems and solve several well-known Node-RED comprehensibility issues, taking inspiration from general design principles. The guidelines have been empirically evaluated by means of an experiment involving a class of Computer Science master students, showing that their application effectively reduces the number of errors and the time required to comprehend Node-RED systems. Moreover, an approach has been drafted to semi-automatically generate Node-RED artifacts and test scripts from a UML model representing the static and dynamic properties of a Node-RED IoT system. Finally, an acceptance testing approach for IoT systems has been formulated, where a UML state machine is used to describe the behavior of the system and drives the development and the testing phases; the acceptance testing approach has been applied on a realistic case study, a mobile health IoT system for diabetes management composed of heterogeneous devices, and compared against an existing runtime verification approach, in terms of strengths and weaknesses. The approach has been able to detect between 71% to 100% of the types of bugs injected in the system.